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Abstract. Efficient scalar multiplication in Abelian groups (which is an im- 
portant operation in public key cryptography) can be performed using digital 
I expansions. Apart from rational integer bases (double-and-add algorithm), 

I imaginary quadratic integer bases are of interest for elliptic curve cryptogra- 

phy, because the Frobenius endomorphism fulfils a quadratic equation. One 
strategy for improving the efficiency is to increase the digit set (at the prize of 
additional precomputations). A common choice is the width-ui non-adjacent 
^ form (?i)-NAF); each block of w consecutive digits contains at most one non- 

Ozero digit. Heuristically, this ensures a low weight, i.e. number of non-zero 
digits, which translates in few costly curve operations. This paper investigates 
the following question: Is the u!-NAF-expansion optimal, where optimality 
means minimising the weight over all possible expansions with the same digit 
I— I set? 

The main characterisation of optimality of «)-NAFs can be formulated in 
the following more general setting: We consider an Abelian group together 
with an endomorphism (e.g., multiplication by a base element in a ring) and 
f*^ a finite digit set. We show that each group element has an optimal ui-NAF- 

expansion if and only if this is the case for each sum of two expansions of 
weight 1. This leads both to an algorithmic criterion and to generic answers 
for various cases. 

1 I Imaginary quadratic integers of trace at least 3 (in absolute value) have 

optimal tiJ-NAFs for w > A. The same holds for the special case of base 
'"^ (zt3zt\/— 3)/2 and w > 2, which corresponds to Koblitz curves in characteristic 

^ three. In the case of r = ±1 it i, optimality depends on the parity of to. 

Computational results for small trace are given. 

p 

2 1. Introduction 

^ I Let r be an imaginary quadratic algebraic integer. We consider r-adic (mul- 

• . ti-) expansions for an element of K[t] using a redundant digit set, i.e. our expansions 

^ need not be unique without any further constraints. The question that arises is how 

to find "good" representations. This problem comes from elliptic curve cryptogra- 
^ phy, where one is interested in expansions leading to efficient calculation schemes. 

^ A scalar multiplication, one of the key operations in in elliptic curve cryptosys- 

tems, can be carried out by a double-and-algorithm or by using the Frobenius 
endomorphism ("Frobenius-and-add"), cf. Koblitz [TS] and Solinas [231 The 
Frobenius endomorphism ip fulfils a quadratic equation ip'^ — pip + q = for integers 
p and q depending on the curve. We identify ip with the complex root r of the same 
equation. We represent a scalar n as n = X]^=o '^i'''"' Vj from some suitable digit 
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set T). Then the scalar multipUcation nP for some P on the curve can be com- 
puted as nP — X]j=o ^i'l^"' (^)- latter sum can be efficiently computed using 
Horner's scheme, where the 77P for 77 G 2? have to be pre-computed. The number 
of applications of ip (which is computationally cheap) corresponds to the length of 
the expansion, the number of additions corresponds to the weight of the expansion, 
i.e. the number of non-zero digits rjj. 

Some of the results of this article do not depend on the setting in an imaginary 
quadratic number field. Those are valid in the following more general (abstract) 
setting and may be used in other situations as well. 

A general number system is an Abelian group A together with a group endo- 
morphism <i> and a digit set V, which is a finite subset of A including 0. The 
endomorphism acts as base in our number system. A common choice is multipli- 
cation by a fixed element. In this general setting we consider multi-expansions, 
which are simply finite sums with summands 4>'^(c?), where k S Nq and d a non- 
zero digit in V. The "multi" in the expression "multi-expansion" means that we 
allow several summands with the same k. If the k are pairwise distinct, we call the 
sum an expansion. Note that in the context of the Frobenius-and-add algorithm, 
multi-expansions are as good as expansions, as long as the weight is low. 

A special expansion is the width-w non-adjacent form, or w-NAF for short. It 
will be the main concept throughout this article. In a ly-NAF-expansion, the k 
in different summands differ at least by a fixed positive rational integer w, i.e. 
considering an expansion as a sequence {rjj)^^^^^^ € T)^" (or alternatively as finite 
word over the alphabet P), each block rjj^uj-i ■ ■ .rij of width w contains at most one 
non-zero digit. The term "non-adjacent form" at least goes back to Reitwiesner [2^ . 
More details and precise definitions of those terms can be found in Section [2] 

Obviously, a w-NAF has low weight and therefore leads to quite efficient scalar 
multiplication in the Frobenius-and-add method. The main question investigated 
in this article is: Does the w-NAF minimise the weight, i.e. the number of non-zero 
digits, among all possible representations (multi-expansions) with the same digit 
set? If the answer is affirmative, we call the ly-NAF-expansion optimal. 

We give conditions equivalent to optimality in Section [3] in the setting of gen- 
eral number systems. We show that each group element has an optimal w-NAF- 
expansion if and only if the digit set is "w-subadditive", which means that each 
multi-expansion with two summands has a w-NAF-expansion with weight at most 2. 
This condition can be verified algorithmically, since there are only finitely many 
non-trivial cases to check. More precisely, one has to consider the w-NAFs corre- 
sponding to w{^'D — 1)^ multi-expansions. Another way to verify w-subadditivity 
is to use the geometry of the digit set. This is done in our imaginary quadratic 
setting, see below. 

Now consider some special cases of number systems, where optimality or non- 
optimality of the non-adjacent form is already known. Here, multiplication by a 
base element is chosen as endomorphism $. In the case of 2-NAFs with digit set 
{—1,0, 1} and base 2, optimality is known, cf. Reitwiesner (35]. This was reproved 
in Jedwab and Mitchell [13] and in Gordon [5]. That result was generalised in 
Avanzi [T, Muir and Stinson [20] and in Phillips and Burgess [H]. There, the 
optimality of the w-NAFs with base 2 was shown. As digit set, zero and all odd 
numbers with absolute value less than 2'"^^ were used. In this setting, there is also 
another optimal expansion, cf. Muir and Stinson [TH]. Using base 2 and a digit 
set {0, l,x} with x G optimality of the 2-NAFs is answered in Heuberger and 
Prodinger [T^]. Some of these results will be reproved and extended to arbitrary 
rational integer bases with our tools in Section [4] That proof will show the main 
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idea how to use the geometry of the digit set to show w-subadditivity and therefore 
optimahty. 

We come back to our imaginary quadratic setting, so suppose that the imaginary 
quadratic base t is a solution of — pr + g = 0, where p and q are rational integers 
with q > Here, K[r] plays the role of the group and multiplication by r 

is taken as the endomorphism. We suppose that the digit set consists of and 
one representative of minimal norm of every residue class modulo r"", which is not 
divisible by t, and we call it a minimal norm representatives digit set. It can be 
shown that, taking such a digit set, every element of K[r] admits a unique w-NAF, 
cf. Blake, Kumar Murty and Xu [71 E] , Koblitz [TB] and Solinas for some 

special cases or Heuberger and Krenn [TT] for a general result. All those definitions 
and basics can be found in Section [6] in a precise formulation. 

First, consider the cases \p\ = 1 and q = 2, which comes from a Koblitz curve 
in characteristic 2, cf. Koblitz [T3], Meier and Staffelbach [THj, and Solinas [531 [H]. 
There optimality of the w-NAFs can be shown for w € {2, 3}, cf. Avanzi, Heuberger 
and Prodinger |5J [3] . The case w = 2 can also be found in Gordon ^ . For the 
cases w e {4, 5,6}, non-optimality was shown, see Heuberger |10j . 

In the present paper we give a general result on the optimality of the w-NAFs 
with imaginary quadratic bases, namely when \p\ > 3, as well as some results for 
special cases. So let \p\ > 3. If w > 4, then optimality of the w-NAFs could be 
shown in all cases. If we restrict to \p\ > 5, then the w-NAFs are already optimal for 
w > 3. Further, we give a condition — p and q have to fulfil a special inequality — 
given, when 2-NAFs are optimal. All those results can be found in Section [Tj There 
we show that the digit set in that cases is ^-subadditive by using its geometry. 

In the last four sections some special cases are examined. Important ones are 
the cases \p\ = 3 and q = 3 coming from Koblitz curves in characteristic 3. In 
KroU T7] optimality of the w-NAFs was shown for w e {2, 3, 4, 5, 6, 7} by using a 
transducer and some heavy symbolic computations. In this article we prove that 
the w-NAF-expansions are optimal for all w > 2, see Section |8] In Section |9] we 
look at the cases \p\ — 2 and q — 2. There the w-NAF-expansions are optimal if 
and only if w is odd. In the cases p = and q > 2, see Section [TO] non-optimality 
of the w-NAFs with odd w could be shown. 

2. Expansions and Number Systems 

This section contains the abstract definition of number systems and the definition 
of expansions. Further, we specify the width-w non-adjacent form and notions 
related to it. 

Abstract number systems can be found in van de Woestijne [25j, which are 
generalisations of the number systems used, for example, in German and Kovacs [Sj. 
We use that concept to define w-NAF-number systems. 

Definition 2.1. A pre-number system is a triple (y^, $,1?) where A is an Abelian 
group, $ an endomorphism of A and the digit set I? is a subset of A such that 
E V and each non-zero digit is not in the image of $. 

Note that we can assume <& is not surjective, because otherwise the digit set 
would only consist of 0. 

Before we define expansions and multi-expansions, we give a short introduction 
on multisets. We take the notation used, for example, in Knuth [T3j. 

Notation 2.2. A multiset is like a set, but identical elements are allowed to appear 
more than once. For a multiset A, its cardinality ^A is the number of elements in 
the multiset. For multisets A and B, we define new multisets Aii) B and A \ B in 
the following way: If an element occurs exactly a times in A and b times in B, then 
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it occurs exactly a + b times in A\±i B and it occurs exactly max(a — b, 0) times in 
A\B. 

Now a pre-number system (and multisets) can be used to define what expansions 
and multi-expansions are. 

Definition 2.3 (Expansion). Lot (A, ^.V) be a pre-number system, and let /x be 
a multiset with elements {d, n) £ {T>\ {0}) x Nq. We define the following: 

(1) We set 

weight(jLt) := #jLt 

and call it the Hamming-weight of n or simply weight of ijl. The multiset 

■q is called finite^ if its weight is finite. 

(2) We call an element {d,n) G /it a singleton and <l>"((i) the value of the sin- 
gleton {d,n). 

(3) Let fj, be finite. We call 

value(/i) := ^ $"(d) 

(d,n)£fi 

the value of /u. 

(4) Let z G A. A multi-expansion of z is a finite /x with value(/i) = z. 

(5) Let z G A. An expansion of z is a multi-expansion /j, of z where all the n 
in {d,n) G fi are pairwise distinct. 

We use the following conventions and notations. If necessary, we see a singleton 
as a multi-expansion or an expansion of weight 1. We identify an expansion rj with 
the sequence {'nn)neNo ^ ^^"j where rjn — d for {d,n) G rj and all other r/„ = 0. 
For an expansion rj (usually a bold, lower case Greek letter) we will use (the 
same letter, but indexed and not bold) for the elements of the sequence. Further, 
we identify expansions (sequences) in J)^" with finite words over the alphabet D 
written from right (least significant digit) to left (most significant digit), except 
left-trailing zeros, which are usually skipped. 

Note, if rj is an expansion, then the weight of rj is 

weight(r?) = #{n e Nq | r?„ ^ 0} 

and the value of r) is 

value(77) = ^ $"(??«) • 

nGNo 

For the sake of completeness — although we do not need it in this paper — a 
prc-numbcr system is called number system if each element of A has an expansion. 
Wc call the number system non-redundant if there is exactly one expansion for each 
element of A, otherwise we call it redundant. We will modify this definition later 
for w-NAF number systems. 

Before going any further, wc want to see some simple^ examples for the given 
abstract definition of a number system. We use multiplication by an element r as 
endomorphism This leads to values of the type 

value(77) = ^ rynr" 

neNo 

for an expansion rj. 

Example 2.4. The binary number system is the pre-number system 



(No, ^^2^, {0,1}). 
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It is a non-redundant number system, since each integer admits exactly one binary 
expansion. We can extend the binary number system to the pre-number system 

(K,z^2z, {-1,0,1}), 

which is a redundant number system. 

In order to get a non-redundant number system out of a redundant one, one can 
restrict the language, i.e. we forbid some special configurations in an expansion. 
There is one special kind of expansion, namely the non-adjacent form, where no 
adjacent non-zeros are allowed. A generalisation of it is defined here. 

Definition 2.5 (Width-w Non-Adjacent Form). Let w be a positive integer and 
I? be a digit set (coming from a pre-number system). Let rj — {rjj)^^^^^ S 1)^°. 
The sequence rj is called a width-w non-adjacent form, or w-NAF for short, if each 
factor r]j-i-w-i ■ ■ ■ Vji each block of length w, contains at most one non-zero digit. 
A w-NAF-expansion is an expansion that is also a w-NAF. 

Note that a w-NAF-expansion is finite. With the previous definition we can now 
define what a w-NAF number system is. 

Definition 2.6. Let w be a positive integer. A pre-number system {A,^,T>) is 
called a w-NAF number system if each element of A admits a w-NAF-expansion, 
i.e. for each z G A there is a w-NAF r] G T>^° with value(r7) = z. We call a w-NAF 
number system non-redundant if each element of A has a unique w-NAF-expansion, 
otherwise we call it redundant. 

Now we continue the example started above. 

Example 2.7. The redundant number system 

2z, {-1,0,1}) 

is a non-redundant 2-NAF number system. This fact has been shown in Reitwies- 
ner [52]. More generally, for an integer w at least 2, the number system 

i-> 2z,V), 

where the digit set D consists of and all odd integers with absolute value smaller 
than 2'^~^, is a non-redundant w-NAF number system, cf. Solinas [231 [M] or Muir 
and Stinson [5D]. 

Finally, since this paper deals with the optimality of expansions, we have to 
define the term "optimal". This is done in the following definition. 

Definition 2.8 (Optimal Expansion). Let {A, $,1?) be a pre-number system, and 
let z € A. A multi-expansion or an expansion /x of z is called optimal if for any 
multi-expansion v of z we have 

weight(/x) < weight(i/) , 

i.e. fi minimises the Hamming-weight among all multi-expansions of z. Otherwise 
/X is called non- optimal. 

The "usual" definition of optimal, cf. [ll[Il[i[Tl[inilIIl[ini[Il[l[31[in],is more 
restrictive: An expansion of z d A is optimal if it minimises the weight among 
all expansions of z. The difference is that in Definition |2.8| we minimise over all 
multi-expansions. Using (multi-)expansions come from an application: we want to 
do efficient operations. There it is no problem to take multi-expansions if they are 
"better", so it is more natural to minimise over all of them instead of just over all 
expansions. 
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3. The Optimality Result 

This section contains our main theorem, the Optimahty Theorem, Theorem |3.2[ 
It contains four equivalences. One of it is a condition on the digit set, one is 
optimahty of the w-NAF. We start with the definition of that condition on the 
digit set. 

Definition 3.1. Let {A,^,T>) be a pre-number system, and let w be a positive 
integer. We say that the digit set V is w -subadditive if the sum of the values of two 
singletons has a w-NAF-expansion of weight at most 2. 

In order to verify the w-subadditivity-condition it is enough to check singletons 
(c, 0) and {d,n) with n € {0, . . . ,w — 1} and non-zero digits c and d. Therefore, 
one has to consider w {^ffD — 1) multi-expansions. 

Theorem 3.2 (Optimality Theorem). Let (^, <I>,2?) be a pre-number system with 

fl $"(^) = {0}, 

me No 

and let w be a positive integer. Then the following statements are equivalent: 

(1) The digit set T> is w- subadditive. 

(2) For all multi- expansions fi there is a w-NAF-expansion ^ such that 

value(^) = value(/i) 

and 

weight(^) < weight(/x) . 

(3) For all w-NAF-expansions t] and i9 there is a w-NAF-expansion ^ such that 

value(^) = value(r7) + va\ue{'d) 

and 

weight(£) < weight(j7) + weight('i9) . 

(4) If z € A admits a multi-expansion, then z also admits an optimal w-NAF- 
expansion. 

Note that if we assume that each element A has at least one expansion (e.g. by 
assuming that we have a w-NAF number system), then we have the equivalence of 
w-subadditivity of the digit set and the existence of an optimal w-NAF-expansion 
for each group element. 

We will use the term "addition" in the following way: The addition of two group 
elements x and y means finding a w-NAF-expansion of the sum x -\- y. Addition of 
two multi-expansions shall mean addition of their values. 

Proof of Theorem \3.S\ For a non-zero z ^ A, we define 

L{z) := max{m g Nq | z G $™(y^)} . 

The function L is well-defined, because 

fl $'"(^) = {0}. 

mSNo 

We show that (Qp implies ^ by induction on the pair (weight(/x) , _L(value(/x))) for 
the multi-expansion fi. The order on that pairs is lexicographically. In the case 
value(/x) — 0, we choose ^ = and are finished. Further, if the multi-expansion 
fl consists of less than two elements, then there is nothing to do, so we suppose 
weight(?7) > 2. 

We choose a singleton {d, n) £ /j, (note that d e 2?\{0} and n S Nq) with minimal 
n and set /x* := fj,\ {{d,n)}. If rt > 0, then we consider the multi-expansion fi' 
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arising from /x by shifting all indices by n, use the induction hypothesis on fjb' and 
apply Note that /x' and /x have the same weight, but 

L(value(/x')) = L(value(/i)) — n < L(value(/i)) . 

So we can assume n = 0. Using the induction hypothesis, there is a u;-NAF- 
expansion 77 of value(/x*) with weight strictly smaller than weight(/x). 

Consider the addition of 77 and the digit d. If the digits 77^ are zero for all 
^ e {0, . . . , w — 1} , then the result follows by setting ^ = . . . r/„,+i77tuO'"^^(i. So we 
can assume 

with a w-NAF /3, a digit 6 7^ and k e {0, . . . , w — 1}. Since the digit set V is 
w-subadditive, there is a w-NAF 7 of $''(6) +(i with weight at most 2. If the weight 
is strictly smaller than 2, we use the induction hypothesis on the multi-expansion 
/SO™ W 7 to get a w-NAF | with the desired properties and are done. Otherwise, 
denoting by J the smallest index with 77 7^ 0, we distinguish between two cases: 
J = and J > 0. 

First let J = 0. The w-NAF /3 (seen as multi-expansion) has a weight less than 
77, so, by induction hypothesis, there is a w-NAF ^' with 

value(l') = value(/3) + value(. . . ^w+ilw) 

and 

weight(l') < weight(/3) + weight(. . . 7^+17^) . 
We set ^ = ^'7u,_i ... 70- Since ^ is a w-NAF-expansion we are finished, because 

value(^) — $™(value(/3)) + <i>"'(value(. . . 7^+i7tu)) + value(7 

w—i • • • 7o ) 

= $™(value(/3)) + $''■(6) + d = value(T7) + d = value(/x*) + d = value(/x) 

and 

weight(^) — weight(^') + weight(7tu_i . . . 70) < weight(/3) + weight(7) 

< weight(77) + 1 < weight(/x*) + 1 = weight(/x) . 

Now, in the case J > 0, we consider the multi-expansion h> := /SO*" W 7. We use 
the induction hypothesis for f shifted by J (same weight, L decreased by J) and 
apply on the result. 

The proofs of the other implications of the four equivalences are simple. To show 
that Q) implies Q), take /x := 77 1±) 1?, and ^ implies |[7J) is the special case when 
77 and 'd are singletons. 

Further, for implies ^ take an optimal multi-expansion /x (which exists, 
since z admits at least one multi-expansion). We get a w-NAF-expansion ^ with 
weight(^) < weight(/x). Since /x was optimal, equality is obtained in the previous 
inequality, and therefore ^ is optimal, too. The converse, implies follows 
using z — value(/x) and the property that optimal expansions minimise the weight. 

□ 

Proposition 3.3. Let (^,$,2?) he a pre-number system with 

fl $"(^) = {0}, 

m6No 

and let w be a positive integer. We have the following sufficient condition: Suppose 
we have sets U and S such that T) C U , —T) Q U , U C <!>([/) and all elements in S 
are singletons. IfV contains a representative for each residue class modulo ^^{A) 
which is not contained in $(.4) and 

($'"-i([/) + [/ + [/) n $'"(y^) C S' U {0} , (3.1) 
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then the digit set V is w -subadditive. 



Sometimes it is more convenient to use (3.1) of this proposition instead of the 
definition of w-subadditive. For example, in Section [4] all digits lie in an interval 
U and all integers in that interval S — U have a w-NAF expansion with weight at 
most 1. The same technique is used in the optimality result of Section [Tj 

Proof of Proposition \3.3\ Let (c, 0) and {d, n) be singletons with n £ {0, . . . ,w — 1} 
and consider y — value((c, 0) W (d, n)). li y = 0, we have nothing to do, so we can 
assume y ^ 0- First suppose y ^ ^{A). Because of our assumptions on T) there is 
a digit a such that 

z := $"(rf) + c-ae 

If z is not zero, then, using our sufficient condition, there is a singleton (6, to) with 
value z, and we have m > w. The w-NAF-expansion 60™^^ a does what we want. 

Now suppose y G ^'^{A) with a positive integer k, which is chosen maximally. 
That case can only happen when n = 0. Since y 7^ and our assumptions on 7) 
there is a w-NAF-expansion of y with a singleton (a, k) as least significant digit. If 
k £ {0, . . . ,w — 1}, then 

z :=d + c-$'=(a) e $"'+''■(-4). 



Then a non-zero z is the value of a singleton (6, m), m > w + k, because of (3.1 1 
and we obtain a w-NAF-expansion of y with singletons {b, m) and (a, k). li k> w 
then 

z ■.= d + ce'^'"+^{A) 



and z is the value of a singleton (6, to) by (3.1 ). We get a w-NAF-expansion 60™. □ 



Sometimes the w-subadditivity-condition is a bit too strong, so we do net get op- 
timal ui-NAFs. In that case one can check whether [w — l)-NAFs are optimal. This 
is stated in the following remark, where the w-subadditive-condition is weakened. 



Remark 3.4. Suppose that we have the same setting as in Theorem |3.2[ We call 
the digit set w-weak-subadditive if the sum of the values of two singletons (c, to) 
and {d, n) with \m — n\ w — 1 has a w-NAF-expansion with weight at most 2. 

We get the following result: If the digit set T> is w-weak-subadditive, then each 
element of A, which has at least one multi-expansion, has an optimal {w — 1)-NAF- 
expansion. The proof is similar to the proof of Theorem |3.2[ except that a "rewrit- 
ing" only happens when we have a {w — l)-NAF-violation. 

4. Optimality for Integer Bases 

In this section we give a first application of the abstract optimality theorem of 
the previous section. We reprove the optimality of the w-NAFs with a minimal 
norm digit set and base 2. But the result is more general: We prove optimality for 
all integer bases (with absolute value at least 2). This demonstrates one basic idea 
how to check whether a digit set is w-subadditive or not. 

Let b be an integer with |&| > 2 and w be an integer with w > 2. Consider the 
non-redundant w-NAF number system 

(K,z 1-^- bz,V) 

where the digit set V consists of and all integers with absolute value strictly 
smaller than ^ \b\^ and not divisible by b. We mentioned the special case base 2 of 



that number system in Example 2.7 See also Reitwiesner [52] and Solinas fMJ. 

The following optimality result can be shown. For proofs of the base 2 setting 
cf. Reitwiesner [22], Jedwab and Mitchell [T3], Gordon [S], Avanzi [T], Muir and 
Stinson [20 , and Phillips and Burgess [21] • 
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Figure 5.1. Voronoi cell V for corresponding to the set Z[r] 
with T = I + |%/3. 



Theorem 4.1. With the setting above, the w-NAF-expansion for each integer is 
optimal. 

Proof. We show that the digit set T) is w-subadditive by verifying the sufficient 
condition of Proposition |3.3[ Then optimality follows from Theorem |3.2[ First, 
note that the w-NAF-expansion of each integer with absolute value at most jbl™"^ 
has weight at most 1, because either the integer is already a digit, or one can divide 
by a power of 6 to get a digit. Further, we have V — —T). Therefore it suffices to 
show that 

6-^ {v"-^v + p + 2?) c [-i |6r, \ i&r'] . 

Let 

for some digits a, c and d. A digit has absolute value less than ^ , so 

\z\<\h\-- {^ht ^2)\\h\- <\h\"-\ 
which was to show. □ 

5. Voronoi Cells 

We first start to define Voronoi cells. Let r G (D be an algebraic integer, imagi- 
nary quadratic, i.e. r is solution of an equation — pr 4- g = with p, g G K and 
such that g - p2/4 > 0. 

Definition 5.1 (Voronoi Cell). We set 

F:={ze€|VyeZ[r]: \z\ < \z - y\} 

and call it the Voronoi cell for corresponding to the set K[t]. Let u G S[t]. We 
define the Voronoi cell for u as 

Vu:=u + V = {u + z\zC,V}^{ze€\\lye %\t\: \z~u\< \z - yW . 

The point u is called centre of the Voronoi cell or lattice point corresponding to the 
Voronoi cell. 



An example of a Voronoi cell in a lattice K[t] is shown in Figure 5.1 Two 
neighbouring Voronoi cells have at most a subset of their boundary in common. 
This can be a problem, when we tile the plane with Voronoi cells and want that 
each point is in exactly one cell. To fix this problem we define a restricted version 
of V . This is very similar to the construction used in Avanzi, Heuberger and 
Prodinger [3j and in Heuberger and Krenn [llj . 
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V 



V2.5 



V5.5 





Figure 5.2. Restricted Voronoi cell V for corresponding to the 
set S[r] with r = | + 1^3. 

Definition 5.2 (Restricted Voronoi Cell). Let Vuhe a Voronoi cell with its centre 
u as above. Let vq, ■ ■ ■ ,Wm-i with appropriate m S N be the vertices of Vu- We 
denote the midpoint of the line segment from Vk to Vk+i by Ufe+1/2, and we use the 
convention that the indices are meant modulo m. 
The restricted Voronoi cell Vu consists of 

• the interior of Vu, 

• the Hne segments from (excluded) to Vk+i (excluded) for all k, 

• the points ^'^+1/2 for fc € {O, . . . , [^J — l}, and 

• the points for k € {l, . . . , [yj }. 

Again we set V :— Vq. 



In Figure 



5.2 



the restricted Voronoi cell of is shown for r = | + ^\/3. The 



second condition in the definition is used because it benefits symmetries. The third 
condition is just to make the midpoints unique. Obviously, other rule^ could have 
been used to define the restricted Voronoi cell. 

The statements (including proofs) of the following lemma can be found in Heuberger 
and Krenn We use the notation B{z,r) for an open ball with centre z and 

radius r and S(z, r) for a closed ball. 

Lemma 5.3 (Properties of Voronoi Cells). We have the following properties: 
(a) The vertices 0/ V are given explicitly by 



vo = 1/2 + (imirf + {Re(r)}^ - {Re(r)}) , 



V, = {Re(r)} - ^ + (lm(r)^ - {Rc(r)}^ + {Re(r)} 



V2 



1/2 + (lm(r)2 + {Re(r)}2 - {Mr)}) ^ Vo - I, 



n = -Vq, 
V4 = -Vl 



and 



V5 = -V2- 

All vertices have the same absolute value. If Re(r) £ TL, then v\ — V2 and 
Vi = ■^5; i-B- the hexagon degenerates to a rectangle. 

(b) The Voronoi cell V is convex. 

(c) We get B{Q, \) C V. 



"'^The rule has to make sure that the complex plane can be covered entirely and with no overlaps 
by restricted Voronoi cells, i.e. the condition (D = {t^zezlr] ^° fulfilled. 
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(a) Digit set for r = (b) Digit set for r = (c) Digit set for t = (d) Digit set for r = 
I + and u; = 2. | + | and = 3. 2 + i and w = 2. | + i ^3 and = 2. 



Figure 6.1. Minimal norm representatives digit sets modulo r™. 
For each digit 77, the corresponding Voronoi cell Vri is drawn. The 
large scaled Voronoi cell is t'^V. 



(d) The inclusion r C V holds. 

6. Digit Sets for Imaginary Quadratic Bases 

In this section we assume that r S (D is an algebraic integer, imaginary quadratic, 
i.e. T is solution of an equation t'^ — pr + q = with p^q G Wj and such that 
q — > 0. By V we denote the Voronoi cell of of the lattice K[r], by V the 
corresponding restricted Voronoi cell, cf. Section [Sj 

We consider w-NAF number systems 

where the digit set V is the so called "minimal norm representatives digit set". 
The following definition specifies that digit set, cf. Solinas [531 [53], Blake, Kumar 
Murty and Xu [S] or Heuberger and Krenn [TT]. It is used throughout this article, 
whenever we have the setting (imaginary quadratic base) mentioned above. 

Definition 6.1 (Minimal Norm Representatives Digit Set). Let w be an integer 
with w > 2 and 2? C K [r] consist of and exactly one representative of each residue 
class of S[t] modulo t*" that is not divisible by r. If all such representatives rj G T) 
fulfil r] € t'^V, then V is called the minimal norm representatives digit set modulo 



The previous definition uses the restricted Voronoi cell V for the point 0, see 
Definition |5.2[ to choose a representative with minimal norm. Note that by con- 
struction of V, there is only one such choice for the digit set. Some examples of 
such digit sets are shown in Figures |6.1[ |8.1[ [9.1| and [10. 1[ 

Re mark 6.2. The definition of a minimal norm representative digit set, De fini 
depends on the definition of the restricted Voronoi cell V, Definition 



tion 



6.1 



5.2 



There we had some freedom in choo sing which part of the boundary is included 



in V, cf. the remarks after Definition 



5.2 



We point out that all results given here 



for imaginary quadratic bases are valid for any admissible configuration of the re- 
stricted Voronoi cell, although only the case corresponding to Definition |5 . 2[ will be 
presented. 

Using a minimal norm representatives digit set, each element of Z[t] corresponds 
to a unique w-NAF, i.e. the pre-number system given at the beginning of this section 
is indeed a w-NAF number system. This is stated in the following theorem, which 
can be found in Heuberger and Krenn jllj . 
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Theorem 6.3 (Existence and Uniqueness Theorem). Let w be an integer with 
w > 2. Then the pre-number system 

where T) is the minimal norm representatives digit set modulo r™, is a non-redundant 
w-NAF number system, i.e. each lattice point z G K[t] has a unique w-NAF- 
expansion ij g 1)^° with z = value(j7). 

7. Optimality for Imaginary Quadratic Bases 

In this section we assume that r g (D is an algebraic integer, imaginary quadratic, 
i.e. r is solution of an equation — pr + g — with p^q a TL and such that 
q — > 0. Further let w be an integer with > 2 and let 

(K[r],z TZ,V) 

be the non-redundant w-NAF number system with minimal norm representatives 
digit set modulo t"", cf. Section |6] 

Our main question in this section, as well as for the remaining part of this article, 
is the following: For which bases and which w is the width- w non-adjacent form 
optimal? To answer this, we use the result from Section [3j If we can show that the 
digit set I? is w-subadditive, then optimality follows. This is done in the lemma 
below. The result will then be formulated in Corollary |7.2[ which, eventually, 
contains the optimality result for our mentioned configuration. 

Lemma 7.1. Suppose that one of the following conditions hold: 

(i) w > 4 and \p\ > 3, 
(ii) w = 3 and \p\ > 5, 
(Hi) w — 3, \p\ — 4: and 5 < g < 9, 
(iv) w ^ 2, p even, and 



or equivalently 



1 2\V p2 
bl >2 



1 <1 




q 



2 



(v) w — 2, p odd and 

1 2\ V p2 2 . ^2 



-1 

, , , , , < 1. 

97 V 4 4 
Then the digit set T> is w -subadditive. 

The conditions ( pv]) an d Q of Lemma |7.1[ i.e. the case w = 2, are illustrated 
graphically in Figure |7TT] 

Proof If 

r'^-iy + y + C r"" mt{V) 

holds, then the digit set V is u;-subadditive since V C t'^V, ~V C t'^V , V C tV 
and z £ r'" int(y) n K[t] implies that there is an integer £ > with z E t^T>. 
The sufhcient condition of Proposition |3.3| was used with U — t'^V and S = 
r"' mi{V) \ {0}. 

Since V is convex, it is sufficient to show that 

t'^-^V + 2V C T''"iut{V). 



OPTIMALITY OF THE WIDTH-iij NON-ADJACENT FORM 



13 



a 



5^^ 



7 
,36) 

,33) 
(8,32) 
(8,31) 
(8,30) 
(8,29) 
(8,28) 
(8,27) 
(8,26) 
(8,25) 
(8,24) 




bound for p odd 

' bound for p even 
\ , L 



Re- 



Figure 7.1. Bounds for the optimality of 2-NAFs. The two curves 
correspond to the conditfons ( [iv| ) and (|v]) 
corresponds to a vahd r 



( pv[ ) and (Q of Lemma 7.1 
If the dot is black. 



A dot 

then the 2-NAFs of 



that T are optimal, gray means not decidable with this method. 
Each dot is labelled with (|p| ,q). 



This will be done by showing 

{\r\-' + 2\r\--) \V\<1 

where \V\ denotes the radius of the smallest closed disc with centre containing V. 
By setting 

np,q,w) ■.= 2{\T\-'+2\Tr") \V\, 

we have to show that 

T{p,q,w) < 1. 
Remark that T(p, q, w) > 0, so it is sufficient to show 

T^{p,q,w) < 1. 

For each of the different conditions given, we will check that the inequality holds 
for special values of p, q and w and then use a monotonicity argument to get the 
result for other values of p, q and w. In the following we distinguish between even 
and odd p. 
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Let first p be even, first. Then 5 + | Im(r) is a vertex of the Voronoi cell V. 
This means \V\ — ^y/l + q — p'^/A. Inserting that and |r| — y/q in the asserted 
inequality yields 

T'ip, q, ^)={^ + ^1-""^') ' (1 + « - t) < 

It is easy to see that the left hand side of this inequality is monotonically decreasing 
in \p\ (as long as the condition q > is fulfilled) and monotonically decreasing 
in w. We assume p > 0. 

If we set p = 4 and w — 4, we get 

12 . 4 12 4 3 
q-± qj ^3/2 q 

which is strictly monotonically increasing for q > 5. Further we get 

lim T2(4,g,4) = 1. 



g— >-oo 

"2/ 



This means T^(4, g, 4) < 1 for all g > 5. Since p > 4 implies g > 5 and because of 
the monotonicity mentioned before, the case ^ for the even p is completed. 
If we set p = 6 and = 3, we get 



. 32 28 4 

T (6,g,3) = ^ ^ hi, 

g'' g^ g 



which is obviously less than 1. Therefore, again by monotonicity, the case is 
done for the even p. 

If we set p = 4 and w — we obtain 

T2(4,g,3) = -1^-4 + 1 + 1, 
g"^ g^ g 

which is monotonically increasing for 5 > g > 18. Further we get 

,242 
7^'(4,9,3) = — <1. 

This means r^(4, g, 3) < 1 for all g with 5 < g < 9. So case |iii| is completed. 
The condition given in ( pv] ) is exactly 

T2(p,g,2) < 1 
for even p, so the result follows immediately. 

Now, let p be odd. Then 21^(t) {^^{t)^ ^0 ^ vertex of the Voronoi cell V . 
This means 

Inserting that in the asserted inequality yields 

T^b, g, n.)=[q-Piy [q-Pl+'^^' {2q-'^ + g" V^)' < 1. 

Again, it is easy to verify that the left hand side of this inequality is monoton- 
ically decreasing in p (as long as the condition g > p^/4 + 1/4 is fulfilled) and 
monotonically decreasing in w. We assume p > 0. 
If we set p = 3 and w — 4, we get 

, 4(g-2)2(g3/2+2)' 

r2(3,g,4) = — J-^ ^ '— 

^ ^ g''(4g-9) 

which is strictly monotonically increasing for g > 3. Further we get 

lim T2(3,g,4) = 1. 
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10)-^(2, ll)-©-(3, 12)-^(4, 14)^(5^ 16) 
A(l,9) ^(2, 10)^(3, ll)-^(4, 13)^(5, 15) 
A(l,8) A(2,9) ^(3,io)-»-(4,12)^(5,i4) 
A(l,7) '*'(2-8) -•-(3,9) -^(4,11)^(5^^3) 
A(l,6) '*>(2'7) ^(3,8) -^(4.10)-,-(5,12) 
A(l,5) 6) ^(3,7) -•■(4,9) 

X(l,4) '*'(2,5) ^(3^g) -•-(4,8) ^(5^10) 
★ (1,3) X(2,4) ^(3^3) ^(4,7) 

.(4,6) 



#(1,2) ^^^'^^ A(3,4) 
*(2,2) 

A(3,3) 



.(5,9) 
.(5,8) 



•(4,5) 



•(5,7) 



Rer 

Figure 7.2. Optimality of a (w— l)-NAF-expansion. Each symbol 
is labelled with {\p\ , g). The number of lines around each symbol 
equals the minimal w for which there is an optimal {w — 1)-NAF- 
expansion of each element of S[t]. 



This means T^(3, g, 4) < 1 for all q > 3. Since p > 3 implies q > 3 and because of 
the monotonicity mentioned before, the case ^ for the odd p is finished. 
If we set p = 5 and w = 3, we get 

^^^^^ 

which is strictly monotonically increasing for q > 7. Further we get 

lim T2(5,g,3) = 1. 

This means < T^{5,q,3) < 1 for all g > 7. As p > 5 implies q > 7, using 
monotonicity again, the case ^ is done for the odd p. 
The condition given in Q is exactly 

T2(p,g,2) < 1 

for odd p, so the result follows immediately. 

Since we have now analysed all the conditions, the proof is finished. □ 

Now we can prove the following optimality corollary, which is a consequence of 
Theorem [321 



Corollary 7.2. Suppose that one of the conditions ^ to of Lemma 7.1 holds. 
Then the width-w non- adjacent form expansion for each element ofTL\T\ is optimal. 



Proof. Lemma |7.1| implies that the digit set T) is w-subadditive, therefore Theo- 
rem [3]2] can be used directly to get the desired result. □ 
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(a) Digit set for r = 
I + and u; = 2. 





(b) Digit set for r = (c) Digit set for t = 
I + f and to = 3. § + f and lo = 4. 



Figure 8.1. Minimal norm representatives digit sets modulo r™. 
For each digit 77, the corresponding Voronoi cell Vri is drawn. The 
large scaled Voronoi cell is t'^V. 



Remark 7.3. We have the following weaker optimality result. Let p, q and w be 
integers with \p\ > po, q > qo and w > wq for a {po, go, wq) G L, where 

L = {(0, 10, 2), (0, 5, 3), (0, 4, 4), (0, 3, 5), (0, 2, 10), 

(1, 2, 8), (2, 3, 4), (2, 2, 7), (3, 7, 2), (3, 3, 3), (4, 5, 2)} . 

Then we can show that the minimal norm representatives digit set modulo r™ 



coming from a t with (p, q) is w-weak-subadditive, and therefore, by Remark 3.4 



we obtain optimality of a (w — l)-NAFs of each element of K[t]. The results are 
visualised graphically in Figure |7.2[ 

To show that the digit set is w-weak-subadditive we proceed in the same way as 



in the proof of Lemma 7.1 We have to show the condition 

T'{p,q,w) < 1 

where 



T'{p,q,w) = 2[\T\-^ + 2\T\ 
with |r| = y^. When p is even, we have 



1^1 



1^1 



l + q 



and when p is odd, we have 



-1/2 / p2 



Using monotonicity arguments as in the proof of Lemma |7.1| yields the list L of 
"critical points". 



8. The p-is-3-g-is-3-CASE 

One important case can be proved by using the Optimality Theorem of Section[3j 
too, namely when r comes from a Koblitz curve in characteristic 3. We specialise 
the setting of Section[7]to p = 3fi with /i e { — 1, 1} and q ^ 3. We continue looking 
at w;-NAF-number systems with minimal norm representative digit set modulo r*" 



with w > 2. Some examples of those digit sets are shown in Figure 8.1 We have 
the following optimality result. 



Corollary 8.1. With the setting above, the width-w non-adjacent form expansion 
for each element of TL [r] is optimal. 
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(a) Digit set for r 
1 + i and w = 2. 




(b) Digit set for r 
1 + i and w = 3. 



(c) Digit set for 
1 + i and ui = 4. 



(d) Digit set for 
1 + i and ui = 5. 



Figure 9.1. Minimal norm representatives digit sets modulo r™. 
For each digit rj, the corresponding Voronoi cell Vjj is drawn. The 
large scaled Voronoi cell is t'^V. 



Proof. Using the statement of Lemma |7.1| and Theorem |3.2| yields the optimality 
for all w > 4. 

Let w = 2. Then our minimal norm representatives digit set is 

p = {0}u U cMi}, 

0<fc<6 

where ^ is a primitive sixth root of unity, see Avanzi, Heuberger and Prodinger [?]. 
Therefore we obtain |2?| = 1 and T) = —V. For k E {0, 1} we get 

t''V + V + V Cb(0,V3 + 2^ cV3'^b(^0,^^ C t"^"" mt{V) , 

so the digit set V is w-subadditive by the same arguments as in the beginning of the 
proof of Lemma |7.1[ and we can apply the Optimality Theorem to get the desired 
result. 

Let w = 3. Then our minimal norm representatives digit set is 
2? = {0}U y C'{1,2,4~/.t}, 

0<fe<6 

where C is again a primitive sixth root of unity, again [4 . Therefore we obtain 
\V\ = |4 - = and again V = -V. For k e {0, 1, 2}, we get 

t''V + V + VCb(q,5V7^ C 73^^(^0,0 C r^'^'intly), 

so we can use Theorem |3.2| again to get the optimality. □ 



9. The p-is-2-g-is-2-CASE 

In this section we look at another special base t. We assume that p € {—2, 2} 
and (7 = 2. Again, we continue looking at u;-NAF-number systems with minimal 
norm representative digit set modulo r'" with w > 2. Some examples of those digit 
sets are shown in Figure [9T] 

For all possible r of this section, the corresponding Voronoi cell can be written 
explicitly as 

V = polygon({i(l + i), + i), - z), |(1 - z)}) . 

Remark that V is an axis-parallel square and that we have 

TV^ = polygon({zJ |je {0,1,2,3}}). 

In this section we will prove that the w-NAFs are optimal if and only if w is odd. 
The first part, optimality for odd w, is written down as the theorem below. The 



non-optimality part for even w can be found as Proposition 9.3 
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Theorem 9.1. Let w be an odd integer with w > 3, and let z G Then the 

width-w non-adjacent form expansion of z is optimal. 

Remark 9.2. Let w be an odd integer with w > 3. Let z e t'^V n S[t], then z can 
be represented as a w-NAF expansion with weight at most 1. To see this, consider 
the boundary of t'^V . Its vertices are 2("'^i)/2i'" for m € {0, 1, 2, 3}. AU elements 
of d{T'^V) n K[t] can be written as 2(™~^'/^i™ + k{l + i)i^'^ for some integers fc, m 
and n. Further, all those elements are divisible by r. Therefore each digit lies in 
the interior of t'^V , and for each z e t""!/ n K[r] there is an integer ^ > such that 
T^^z G 2?, because t^^V C V and |t| > 1. 



Proof of Theorem \9.1\ We prove that the digit set V is w-subadditive. Hence, 
optimality follows using Theorem |3.2| Using the remark above, T) = —V and the 
ideas of Proposition |3.3[ it is sufficient to show 

r"*" {t^V + 13 + P) n TL\t\ C t'^V 

for fc e {0, . . . ,w; - 1}. 

Let k = w — \. We show that 

+ r-("'-i) (23 + 23)) n tTL\t\ C r™+ V. (9.1) 



So let y = 6 + a be an element of the left hand side of (9.11 with 6 € 23 and 
a e r-("'-i) (23 + 23). We can assume y 0. Since y &TL\t\ and 23 C K[t], we have 
a e Z[r]. Since 23 C r^'V, we obtain 

^-(w-\) + c 2tV. 

Because 2tV = t^V C t^F, we can assume & 7^ 0. This means t | 5. Since 
r I y, we have T\a. The set 2tV n K[t] consists exactly of 0, i™, 2z™ and rz™ 
for TO £ {0, 1,2,3}. The only elements in that set not divisible by r are the i™ . 
Therefore a = i"^ for some to. The digit b is in the interior of t'^V, thus y = b + a 
is in r^y C r™+iy. 

Now let A; e {0, . . . , w - 2}. If w > 5, then 

T"'" (t''23 + 23 + 23) C r^'^^y _^ 2F, 

using 23 C r™V^ and properties of the Voronoi cell V. Consider the two squares 
^w-2y ^wy _ 2t'^-'^v. The distance between the boundaries of them is at 
least i Irl™"^, which is at least \/2- Since 21^ is contained in a disc with radius -\/2, 
we obtain t'^'^V + 2V C t'^V. 

We are left with the case w = 3 and k € {0, 1}. There the digit set 23 consists 
of and for to e {0, 1, 2, 3}. Therefore we have 23 C tF (instead of 23 C r^V). 
By the same arguments as in the previous paragraph we get 

T-^ {t^V + V + V) <z\{tV + 2V)Q t^V, 

so the proof is complete. □ 

The next result is the non-optimality result for even w. 

Proposition 9.3. Let w be an even integer with w > 2. Then there is an element 
of%\T\ whose w-NAF- expansion is non-optimal. 



Again, some examples of the digit sets used are shown in Figure |9.1| The proof 
of the proposition is split up: Lemma |9.4| handles the general case for even w > A 



and Lemma 9.5 gives a counter-example (to optimality) for w — 2. 



For the remaining section — it contains the proof of Proposition 9.3 — we will 
assume r = 1 + i. All other cases are analogous. 



Lemma 9.4. Let the assumptions of Proposition 9.3 hold and suppose w > A. 
Define A := Irf \{l - i) and B := and set s = -i^-^l'^. Then 
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11 -B - 1 r'^V 




A-T 



Figure 9.2. The w-is-even situation. The figure shows the config- 
uration p — 2, q = 2^ w = s = 1. A polygon filled grey represents 
a digit, a dot represents a point of interest in Lemma 



9.4 



(a) 1, i, — f and —i are digits, 
(h) A — 1 is a digit, 
(c) —B — I is a digit. 



(d) ir" 



is a digit, and 



(e) we have 

{A - 1)t'"-^ + 



ST^"^ + {-B - f )r"' + (ir'' 



Figure |9.2| shows the digits used in Lemma |9.4| for a special configuration. 



Proof, (a) A direct calculation shows that the lattice elements f , z, — f and — i are 
in the interior of 



'V ^ 



-2' 



-)w/2-l r)w/2-l 



and are not divisible by r. So all of them are digits, 
(b) We can rewrite A as 

A = 2'"/2-i(i _ j) = -2"'/2-izT, 

therefore | A. We remark that A is a vertex (the lower-right vertex) of the 
scaled Voronoi cell t'^V and that the edges of t'^V are parallel to the real and 
imaginary axes. This means that A ~ 1 is on the boundary, too, and its real 
part is larger than 0. By using the construction of the restricted Voronoi cell, 
cf. Definition . 



5.2 



we know that A — 1 is in t'"V. Since it is clearly not divisible 
by r, it is a digit, 
(c) We have 

B= iyl = -2"'/2-ii. 

T 

Therefore t \ B, and we know that B halves the edge at the bottom of the 
Voronoi cell t^V. By construction of the scaled restricted Voronoi cell t'^V, 
cf. Definition |5.2[ we obtain that B -I- 1 is a digit, and therefore, by symmetry, 
—B — 1 is a digit, too. 
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(d) Rewriting yields 

IT"' " — S 

and we obtain 

since (1 + i)^ = 2i. Further we can check that the vertices of t'^V are i^T'^~^ 
for an appropriate fc e 

Now consider isr"^^^ . This is exactly the lower- right vertex A of t'^V . 
Therefore, we have 



IT 



w—1 



-s-^ =s-\A-l). 



Using that A— \ is a digit and the rotational symmetry of the restricted Voronoi 
cell, iT'^~^ — is a digit, 
(e) As before, we remark that st^ = — 2™/^i. Therefore we obtain 

B-I-st"" ^-B-1. 

Now, by rewriting, we get 

{A - l)r"'-i + (-S-1) = {A- t)t"'-i + (ir™-i - s'^) 
= (B-l)r"' + (ir™-i-s-i) 



ST 



which was to prove. □ 



Lemma 9.5. Let the assumptions of Proposition 9.3 hold and suppose w = 2. Then 

(a) —1 and —i are digits and 
(h) we have 

— r — 1 = — ir^ — — ir^ — i. 

Proof, (a) The elements —1 and — i are on the boundary of the Voronoi cell r^V^, 
cf. Figure Q.l^a) More precisely, each is halving an edge of the Voronoi cell 
mentioned. The construction of the restricted Voronoi cell, together with the 
rotation and scaling of = 2i, implies that —1 and —i are in t'^V . Since none 
of them is divisible by r, both are digits. 

(b) The element i has the 2-NAF-representation 

i — —iT^ — t"^ — i. 

Therefore we obtain 

— T — 1 = (—1 + i)T + (ir — 1) = ir^ + (— i) — —it^ — t'' — ir'^ — i, 
which was to show. □ 
Finally, we are able to prove the non-optimality result. 



Proof of Proposition \ 9. 5| Let w > 4. Everything needed can be found in Lemma [9.4[ 
We have the equation 

{A - l)r'"-i + {-s-^) = sr^"' + {-B - l)r'" + (ir"'"! - s'^), 

in which the left and the right hand side are both valid expansion (the coefficients 
are digits). The left hand side has weight 2 and is not a w-NAF, whereas the right 
hand side has weight 3 and is a w-NAF. 

Similarly the case w = 2 is shown in Lemma |9.5[ We have the equation 



-T — 1 = — ir® — — ir^ — i. 



which again is a counter-example to the optimality of the 2-NAFs. □ 
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(a) Digit set for 
i\/2 and ui = 3. 



(b) Digit set for 
i\/2 and ui = 5. 



(c) Digit set for 
i\/3 and ui = 3. 



(d) Digit set for 
i\/3 and w = 5. 



Figure 10.1. Minimal norm representatives digit sets modulo r™. 
For each digit t], the corresponding Voronoi cell V^i is drawn. The 
large scaled Voronoi cell is t'^V. 



10. The p-is-O-Case 

This section contains another special base t. We assume that p = and that we 
have an integer q > 2. Again, we continue looking at w-NAF-number systems with 
minimal norm representative digit set modulo r™ with w > 2. Some examples of 
the digit sets used are shown in Figure |10.1| 

For all possible r of this section, the corresponding Voronoi cell can be written 
explicitly as 

V = polygon({i(r + 1), ^(t - 1), i(-T - 1), i(-T + 1)}) . 

Remark that V is an axis-parallel rectangle. 

In this section we prove the following non-optimality result. 

Proposition 10.1. Let w be an odd integer with w > 3 and the setting as above. 
Then there is an element o/Z[r] whose w-NAF- expansion is non-optimal. 

For the remaining section — it contains the proof of the proposition above — we 
will assume r = iy/q. The case r — —i^fq is analogous. Before we start with the 
proof of Proposition |10.1 we need the following two lemmata. 



Lemma 10.2. Let the assumptions of Proposition \10. 1\ hold, and suppose that q is 
even. Define A:^\ \t["^^ and B := ^A, and set s = (-l)5("'+i). Then 

(a) 1 and —1 are digits, 

(b) A — 1 — T is a digit, 

(c) —B — \ is a digit, 

(d) — s — T^^^ is a digit, and 

(e) we have 



- 1 - t)7 



ST^"" + {-B - 1)t'" + 



Figure |10.2| shows the digits used in Lemma 10. 2| for a special configuration 



Proof, (a) A direct calculation shows that —1 and 1 are in an open disc with radius 
I |t|"', which itself is contained in t'^V. Both are not divisible by r, so both 
are digits. 

(b) Because w is odd, q is even and r = iy^, we can rewrite the point A as 



A 



1 



\w + l 



and see that A is a (positive) rational integer and that r™"-*^ | A. Furthermore, 
A halves an edge of t'^V . Therefore, A—\\s inside t^V . If g > 4 or w; > 5, the 
point A—1 — T\s inside t'^V , too, since the vertical (parallel to the imaginary 
axis) side-length of t'^V is |t|™ and |r| < ^ Since | A, we obtain 
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-B-1 



III n iL 



B-1 B 



A 

A-T 



Figure 10.2. The g-is-even situation. The figure shows the con- 
figuration p = 0, g = 4, r = 2z, w = 3, s = 1. A polygon 
filled grey represents a digit, a dot represents a point of interest in 



Lemma 10.2 



t\A—1 — t, so A—1~T is a digit. If g = 2 and w = 3, we have A—1~t — 1 - 



5.2 



-T. 

we 



Due to the definition of the restricted Voronoi cell V , cf. Definition 
obtain that 1 — r is a digit, 
(c) Previously we saw t^~'^ | A. Using the definition of B and w > 3 yields t\B. It 
is easy to check that B = ^sr™. Furthermore, we see that B is on the boundary 
of the Voronoi cell t^V . By a symmetry argument we get the same results for 
—B. By the construction of the restricted Voronoi cell V , cf. Definition 



5.2 



we 



obtain that —B — 1 is in t^V and since clearly t\{—B — 1), we get that —B — 1 
is a digit. 

(d) We first remark that r™^^ e K and that It™"^! < A. Even more, we get 



< 



-ST" 



< A. Since A is on the boundary of t'^V, we obtain —1 



ST™ ^ e t"" int(F). By symmetry the result is true for — s — and clearly 



(e) We get 



^ is a digit. 



{A-1-t)t^-^ + i-s) 



= {B- l)r"' + (-S - t"'-^) 



2w 



+ i-B - ly^" + (- 



which can easily be verified. We used B = ^A. 



□ 



B' 



and set 



Lemma 10.3. Let the assumptions of Proposition \10.1\ hold, and suppose that q 
is odd. Define A' := \ |rr+\ B' \A, A -.^ A! - \ and I 
C = -A, t = {q+l)/2 and s = (-l)3(«'+i) e {-1, 1}. Then 

(a) 1 and — 1 are digits, 

(b) A — T is a digit, 

(c) sC is a digit, 

(d) —B ~ I is a digit, 

(e) sC — tr^^^ is a digit, and 

(f) we have 



{A-t)t'"-^ + {sC) 



2w 



+ (-B-l)T"' + (sC-tr"'-i). 
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Figure 10.3. The g-is-odd situation, The figure shows the con- 
figuration p = 0, q = 5, T = i^/b, w — 3, s = 1. A polygon 
filled grey represents a digit, a dot represents a points of interest 



in Lemma 10.3 



Figure [TO . 3| shows the digits used in Lemma [10. 3| for a special configuration. 



Proof, (a) See the proof of Lemma 10.2 
(b) We can rewrite the point A as 



A 



(tu+l) 



1 



1 I ,w+l 1 

2'"' "2 2 

Since q is odd with q > S and w is odd with w > 3, we obtain A G Z with 
< A < ^ |Tr+^ and q\A. Therefore t \ A and A is in the interior of the 
Voronoi cell t'^V. The vertical (parallel to the imaginary axis) side-length of 
t'^V is Irj™ and |r| < ^ \t\^ , so A — r is in the interior of t^V, too. Since 
t\ A — T, the element A — r is a digit. 

(c) We got t\ A and A is in the interior of the Voronoi cell t'^V. Therefore A is a 
digit, and — by symmetry — sC is a digit, too. 

(d) We obtain 



B 



i-\/Q = -T ( - 
2^ 2 V 



1 



which is inside t'^V. Therefore the same is true for —B. The horizontal (parallel 
to the real axis) side- length of t^V is larger than 2, therefore —B — 1 is inside 
r'"y, too. Since t \ B we get t\{-B - 1), so -B - 1 is a digit, 
(e) We obtain 



<s sC-tT" 



This means that sC — tr*' 



_ 1 
" 2 



1) \Tr' - \r\ 



1 I r 
<-,\r\ 



1 



is in the interior of the Voronoi cell t'^V. Since 



t\ {—A) = C, the same is true for sC — tT^ ^, i.e. it is a digit. 
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(f) We get 

{A - r)r'"-i + (sC) = {A-t + t)T'"-^ + {sC - tr'^^^) 
= {B-1- t)t"' + (sC - ir*"-!) 
= sr^"- + (B - 1 - r - sr'")r"' + (sC - ir^'-^) 
= sr^"- + (-B - 1)t"' + (sC - ir*"-!), 
which can be checked easily. □ 

The two lemmata above now allow us to prove the non-optimality result of this 
section. 

Proof of Proposition \10.1\ Let q be even. In Lemma |10.2| we got 

{A- I- T)r"'-i - s = ST^"" + {-B - l)r^ + (-s - r^-^) 

and that all the coefficients there were digits, i.e. we have valid expansions on the left 
and right hand side. The left hand side has weight 2 and is not a w-NAF, whereas 
the right hand side has weight 3 and is a w-NAF. Therefore a counter-example to 
the optimality was found. 

The case q is odd works analogously. We got the counter-example 

{A ~ t)t'"-^ + (sC) = ST^*" -t- {-B - 1)t'" -t- {sC - tr""-^) 

in Lemma [10.31 □ 

11. Computational Results 

This section contains computational results on the optimality of w-NAFs for 
some special imaginary quadratic bases r and integers w. We assume that we have 
a T coming from integers p and q with q > Again, we continue looking at 

w-NAF-number systems with minimal norm representative digit set modulo r™ 
with w >2. 

As mentioned in Section |3] the condition w-subadditivity-condition — and there- 
fore optimality — can be verified by finding a w-NAF-expansion with weight at 
most 2 in w (#1? — 1) cases. The computational results can be found in Figure 11.1 
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Figure 11.1. The optimality map including computational re- 
sults. Below each block the parameters p and q (fulfilling —pT + 
q = 0) are printed. A block is positioned according to r in the 
complex plane. Above each block are the ru. The symbol O means 
that the if-NAF-expansions are optimal, N means there are non- 
optimal w-NAF-expansions. If a result is surrounded by a circle, 
then it is a computational result. Otherwise, if there is no circle, 
then the result comes from a theorem given here or was already 
known. A dot means that there is no result available. 
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